SEBI Penalty on CDSL: One Crore Rupees for Pledge, Unpaid Securities and Cybersecurity Lapses
A depository has been fined one crore rupees twice in just over three months. The second SEBI penalty on CDSL came on October 30, 2026, and unlike the first it has nothing to do with a cyberattack. It comes out of a routine inspection, and the findings are the kind that any market intermediary could be carrying without knowing it.
What Was Decided
The Securities and Exchange Board of India imposed a penalty of one crore rupees on Central Depository Services (India) Limited. The order follows an inspection of the depository for the financial year 2023-24 and the show cause notice issued on the inspection findings.
The order carries three groups of findings: one on the recording of pledges, one on the client unpaid securities account, and one on cybersecurity and disaster recovery. They are worth taking separately, because they fail for different reasons.
The Pledge Finding
Where a pledge request is rejected, the depository did not communicate the reasons to the depository participants of both the pledgor and the pledgee. SEBI treated that as a breach of a statutory obligation rather than a procedural slip.
The obligation sits in regulation 79(5) of the SEBI (Depositories and Participants) Regulations, 2018. Where the depository does not create the pledge, it is to send the reasons to the participants of the pledgor and of the pledgee. Both sides are named in the provision, and a practice of informing one and not the other does not answer it.
The point has a practical edge beyond the depository. A pledgee who is never told why a pledge was not recorded cannot fix the defect, and a lender relying on dematerialised securities as collateral has no way of knowing whether its security interest exists.
The Client Unpaid Securities Account
The order also finds that the requirements governing the operation of the client unpaid securities account were not followed. The two accounts of the order describe the failure in different terms, so nothing is said here about its particulars.
What can be said is that this is an account whose whole purpose is to hold securities a client has not paid for, under controls that keep them out of circulation until the position is settled. On an account of that kind the control is the whole of the protection, which is why a lapse in operating it is treated as substantive.
The Cybersecurity and Disaster Recovery Findings
Three cybersecurity findings are common to both accounts of the order. Measures to prevent unauthorised transmission of data out of the organisation were not fully in place. Identified vulnerabilities were not patched within the period SEBI prescribes. The vulnerability assessment and penetration testing exercise was not comprehensive, because it did not cover all the relevant domains and external applications.
The order also faults the conduct of the disaster recovery drill. Here too the two accounts describe the shortcoming differently, so it is recorded as a finding on the drill and no further.
The common thread is that none of these is a breach discovered through an incident. Each is a gap between what the framework requires and what the inspection found, which is why an inspection cycle rather than an attack produced them.
The Second One Crore Rupees in Just Over Three Months
In July 2026 the same depository was penalised one crore rupees over a different matter. Its own intimation to the exchange, dated July 20, 2026, records a SEBI letter of that date concerning a malware incident of November 18, 2022, carrying observations on cyber security and operational resilience.
That penalty was imposed under section 15HB of the SEBI Act, 1992 and section 19G of the Depositories Act, 1996. The two orders are about different things. The July order proceeds from an incident, and the October order from an inspection. Reading the second as a follow-up to the first misreads both.
One Crore Rupees Is the Ceiling
Section 15HB of the SEBI Act and section 19G of the Depositories Act are the residual penalty provisions, each applying where a contravention of the Act, the rules, the regulations, the bye-laws or a direction of the Board attracts no separate penalty. Each sets a floor of one lakh rupees and a ceiling of one crore rupees. The present figures in section 15HB were substituted by the Securities Laws (Amendment) Act, 2014.
That matters for reading the July figure. It was not a mid-range number chosen from a wide band: where the residual provision is the one in play, one crore rupees is as far as a penalty can go. Nothing is said here about the provision behind the October figure, because the accounts of that order do not agree on it.
What the Order Signals
The findings are unglamorous and that is the point. Reasons not passed on, an account control not operated as designed, patches not applied in time, a testing exercise with gaps in its scope. None of them would make a headline on its own, and together they drew one crore rupees.
For an institution carrying obligations of this kind, the inference is that the scope of a testing exercise and the completeness of a notification are treated as substantive obligations rather than as housekeeping. An annual assurance exercise that confirms a control exists, without confirming that it covers everything it is supposed to cover, will not detect any of these four.
Key Takeaways
The order is dated October 30, 2026: A penalty of one crore rupees on Central Depository Services (India) Limited, arising from the inspection for the financial year 2023-24.
Pledge rejection reasons must reach both participants: Regulation 79(5) names the participants of the pledgor and of the pledgee, and informing one is not compliance.
A client unpaid securities account control was not followed: The two accounts of the order differ on the particulars, so only the finding itself is reported.
Three cybersecurity findings are common to both accounts: Measures against unauthorised transmission of data were incomplete, identified vulnerabilities were not patched in time, and the testing exercise did not cover all domains and external applications.
The disaster recovery drill was also faulted: The particulars differ between accounts and are not reported.
This is the second one crore rupee penalty in just over three months: The July 2026 order concerned a malware incident of November 2022 and was imposed under section 15HB of the SEBI Act and section 19G of the Depositories Act.
One crore rupees is the maximum under each of those provisions: Both carry a floor of one lakh rupees and a ceiling of one crore rupees, so the July figure was the ceiling and not a mid-range number.
Scope is the recurring defect: A control that exists but does not cover everything it should is what the inspection caught.
Key Statutory Provisions
Section 15HB of the Securities and Exchange Board of India Act, 1992: Penalty for contravention where no separate penalty has been provided. Not less than one lakh rupees, extending to one crore rupees. The present figures were substituted by the Securities Laws (Amendment) Act, 2014.
Section 19G of the Depositories Act, 1996: Penalty for contravention where no separate penalty has been provided, in the same terms, with a floor of one lakh rupees and a ceiling of one crore rupees.
Regulation 79 of the SEBI (Depositories and Participants) Regulations, 2018: Pledge or hypothecation of dematerialised securities. Sub-regulation (5) requires the depository, where it does not create the pledge, to send the reasons to the participants of the pledgor and of the pledgee.
Sources and References
Report of the order, with the findings and the provision relied on
Independent report of the same order, with the same pledge and cybersecurity findings
The depository's own intimation to the exchange about the July 2026 penalty
SEBI Act, 1992, section 15HB; Depositories Act, 1996, section 19G; SEBI (Depositories and Participants) Regulations, 2018, regulation 79
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments